Threats tagged 'ghsa-3h5r-7p7q-xv68'

The Kali Forms WordPress plugin before version 2.4.30 contains a vulnerability where its test-email handler does not perform proper capability checks. This flaw allows any authenticated user with minimal privileges (Subscriber and above) to disclose the email addresses of any registered user, including administrators, by exploiting a nonce that is accessible to all logged-in users.